Threat Intelligence Database

The nnn file manager stores the homelen variable as an unsigned char type, which can only represent values from 0 to 255. This causes an integer truncation issue when handling HOME paths longer than 255 characters, potentially leading to a negative value after promotion and resulting in an out-of-bounds read and write one byte before the path buffer. Version 5.2 has been confirmed vulnerable. No official patch or affected version range has been provided by the maintainer.

The nnn file manager does not sanitize the path variable, allowing an attacker to craft directory names containing shell syntax that can be executed during batch copy or move operations. This vulnerability was confirmed in version 5.2. The flaw enables command injection with the privileges of the nnn process when a user enters a malicious directory and uses batch workflows.